POWERED BY MOMENTUM MEDIA
Email security lapses widespread among super funds
Earlier this month, several Australian superannuation funds fell victim to credential stuffing attacks, which saw a small number of members lose more than $500,000.
Sadly, it appears many such funds are still prone to compromise.
Cyber security firm Proofpoint has released new research into the email security of Australian super funds and the most alarming statistic is that 58 per cent of funds are falling behind on the most basic security measures.
“Australian superannuation funds hold the financial futures of millions of everyday Australians, yet our research reveals 58 per cent are failing to implement basic email security protocols,” said Steve Moros, senior director, advanced technology group, Asia Pacific and Japan at Proofpoint.
“This security gap creates a dangerous opening for cyber criminals who specifically target these data-rich organisations.”
Proofpoint conducted Domain-based Message Authentication, Reporting and Conformance (DMARC) analysis of more than 80 Australian funds and found that 8 per cent don’t have any DMARC protection at all, while only 42 per cent have the highest level of DMARC protection.
DMARC has three levels of protection – monitor, quarantine, and reject, the latter of which is the highest level of protection. The protocol is designed to prevent domain names from being misused by cyber criminals.
According to the research, 23 per cent of Australian funds use the quarantine level of protection and 27 per cent use the monitor level.
“The recent breach resulting in over $500,000 in losses demonstrates these threats aren’t theoretical and, in fact, regular occurrences growing in volume. They’re actively impacting Australians’ retirement savings,” Moros said.
“While resource constraints are understandable, implementing robust DMARC protection isn’t optional in today’s threat landscape – it’s essential infrastructure that stands between members’ life savings, their privacy and increasingly sophisticated fraud campaigns targeting these critical financial institutions.”
The analysis was conducted based on a list of APRA-regulated super funds in April this year.
Earlier this month, speaking at Momentum Media’s Election 2025 breakfast event in Sydney, Mary Delahunty, CEO of the Association of Superannuation Funds of Australia (ASFA), took a moment to address the cyber incident that gripped some Australian super funds last week.
Initially, the funds affected by the incident included Rest, Hostplus, AustralianSuper, Insignia’s Expand platform, and Australian Retirement Trust, followed later by Cbus Super and Media Super, which raised alarms after a surge of suspicious login attempts.
“I’m sure all of you are aware of the cyber incident that affected several superannuation funds recently. It’s now being investigated by police and government authorities,” Delahunty said.
“While I can’t say a lot at the moment, I can say that the cyber criminals undertook a coordinated, well-funded and sophisticated attack on our system.
“The superannuation sector is taking this extremely seriously, as we should.”
Delahunty said at the time that reviews are underway to assess where further protections are needed.
Recommended for you
The pace of economic growth in Australia is expected to “grind higher over coming quarters” off the back of lower inflation, falling interest rates, and a robust labour market, Deloitte has said.
The superannuation sector has welcomed confirmation that a controversial US tax provision will be removed.
A new analysis from environmental finance group Market Forces has reportedly discovered that AustralianSuper is on the b...
Treasurer Jim Chalmers has held talks with US Treasury Secretary Scott Bessent, intensifying efforts to resolve concerns over section 899 of the proposed “Big Beautiful Bill” in the United States.
TOP PERFORMING FUNDS
ACS FIXED INT - AUSTRALIA/GLOBAL BOND
Fund name
3y(%)pa
1
DomaCom DFS Mortgage
92.15 3 y p.a(%)
2
Global X 21Shares Bitcoin ETF
53.24 3 y p.a(%)
3
Global X GlobalX FANG+ ETF
43.15 3 y p.a(%)
4
DomaCom Shoreline North Coogee
36.26 3 y p.a(%)
5
GAM LSA Private Shares AU I
35.87 3 y p.a(%)
